Security specialists often perform forensic investigations on computer systems following malicious attacks. These investigations can reveal evidence, which may be applied to ascertain the scope of the attacks and to assist in developing safeguards to prevent similar attacks from recurring. Forensic investigations can also be performed to gather evidence related to suspect activity involving a computer. In some cases, collected evidence may be applied in law enforcement or in civil actions seeking monetary damages.
Various tools have been developed to assist in forensic investigations. For example, NextGen is a forensic tool available from NetWitness® of Reston, Va., which performs real-time network forensics using full packet capture and session analysis. NextGen also provides a number of analytic tools, which allow users to trace malware propagation over a network.
Also, Continuous Data Protection (CDP) saves backups of all changes to a computer's disk, so that each change is retained. CDP solutions allow users to restore the state of their disk drives to any point in time for which CDP was active. CDP can be used forensically to trace the propagation of malware or data corruption through different files or blocks of a user's machine. It can also be used to restore content containing suspect or illegal materials, which may have been deleted from the user's hard drive but retained in the CDP backup.